Refuse non-string plugin refs and Bot ids before the store

CHANGELOG.md

@@ -8,6 +8,11 @@ Newest first. `Unreleased` is what is on `main` and not yet tagged.
 
 ## Unreleased
 
+### A non-string plugin grant or tool call is refused before it reaches the store
+
+`POST /api/plugins/grants` and `POST /api/plugins/call` checked presence, not shape, so a JSON
+number, object, or whitespace string passed and failed inside the store as a 500. Refs and Bot
+ids must be non-empty strings now, and anything else is a 400 naming what is required.
 ### A fractional or infinite snapshot id is refused as malformed, not stale
 
 A `snapshotId` of `1.5` or `Infinity` passed the acting routes and never matched the stored

server/src/plugins/routes.ts

@@ -770,7 +770,18 @@ export function createPluginRoutes(
       agentId?: string;
     } | null;
     const kind = asGrantKind(body?.kind);
-    if (!kind || !body?.ref || !body.agentId) {
+    /*
+     * The body is JSON, so the annotation is a wish: `{"ref":123,"agentId":[]}` passes a
+     * truthiness check and then reaches the store, where Drizzle compares a text column against
+     * a number and the request answers 500. A ref and a Bot id are non-empty strings here.
+     */
+    if (
+      !kind ||
+      typeof body?.ref !== "string" ||
+      !body.ref.trim() ||
+      typeof body.agentId !== "string" ||
+      !body.agentId.trim()
+    ) {
       return context.json(
         { error: "A kind, a ref and a Bot are required." },
         400,
@@ -841,7 +852,14 @@ export function createPluginRoutes(
       args?: Record<string, unknown>;
       agentId?: string;
     } | null;
-    if (!body?.ref || !body.agentId) {
+    // Same shape lie as `/grants` above: JSON numbers, objects and arrays are truthy, so they
+    // must be refused here rather than inside `canUseBot` or the tool call.
+    if (
+      typeof body?.ref !== "string" ||
+      !body.ref.trim() ||
+      typeof body.agentId !== "string" ||
+      !body.agentId.trim()
+    ) {
       return context.json({ error: "A tool and a Bot are required." }, 400);
     }
 

server/tests/plugin-grants-validation.test.ts

@@ -0,0 +1,88 @@
+import { describe, expect, test } from "bun:test";
+import type { MiddlewareHandler } from "hono";
+import type { AppVariables } from "../src/auth/guards";
+import type { BotAccessCheck } from "../src/plugins/routes";
+import { createPluginRoutes } from "../src/plugins/routes";
+import type { PluginStore } from "../src/plugins/store";
+
+function appWith(calls: { grants: unknown[]; toolCalls: unknown[] }) {
+  const store = {
+    grant: async (kind: unknown, ref: unknown, agentId: unknown) => {
+      calls.grants.push({ kind, ref, agentId });
+      return { ok: true };
+    },
+    callTool: async (input: unknown) => {
+      calls.toolCalls.push(input);
+      return { ok: true };
+    },
+  } as unknown as PluginStore;
+  const requireUser: MiddlewareHandler<{ Variables: AppVariables }> = async (
+    context,
+    next,
+  ) => {
+    context.set("actor", {
+      id: "user-1",
+      email: "user@openbot.test",
+      role: "admin",
+    });
+    await next();
+  };
+  const canUseBot: BotAccessCheck = async () => true;
+  return createPluginRoutes(store, requireUser, canUseBot);
+}
+
+/**
+ * The body is JSON, so the annotation is a wish.
+ *
+ * `{"ref":123,"agentId":[]}` is truthy and used to pass the presence check, then reach the store
+ * where Drizzle compares a text column against a number and the request answers 500. A ref and a
+ * Bot id are non-empty strings; anything else is a 400 before any grant, call, or audit row.
+ */
+describe("POST /api/plugins/grants", () => {
+  test.each([
+    ["a number ref", { kind: "mcp", ref: 123, agentId: "bot-1" }],
+    ["an object ref", { kind: "mcp", ref: {}, agentId: "bot-1" }],
+    ["a number agentId", { kind: "mcp", ref: "tool", agentId: 456 }],
+    ["an array agentId", { kind: "mcp", ref: "tool", agentId: [] }],
+    ["a whitespace ref", { kind: "mcp", ref: "   ", agentId: "bot-1" }],
+    ["a whitespace agentId", { kind: "mcp", ref: "tool", agentId: "  " }],
+  ])("refuses %s with 400 and never reaches the store", async (_n, body) => {
+    const calls = { grants: [] as unknown[], toolCalls: [] as unknown[] };
+    const response = await appWith(calls).request(
+      "http://openbot.test/grants",
+      {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify(body),
+      },
+    );
+
+    expect(response.status).toBe(400);
+    await expect(response.json()).resolves.toEqual({
+      error: "A kind, a ref and a Bot are required.",
+    });
+    expect(calls.grants).toEqual([]);
+  });
+});
+
+describe("POST /api/plugins/call", () => {
+  test.each([
+    ["a number ref", { ref: 123, agentId: "bot-1" }],
+    ["an object ref", { ref: {}, agentId: "bot-1" }],
+    ["a number agentId", { ref: "tool", agentId: 456 }],
+    ["a whitespace ref", { ref: "  ", agentId: "bot-1" }],
+  ])("refuses %s with 400 and never reaches the store", async (_n, body) => {
+    const calls = { grants: [] as unknown[], toolCalls: [] as unknown[] };
+    const response = await appWith(calls).request("http://openbot.test/call", {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify(body),
+    });
+
+    expect(response.status).toBe(400);
+    await expect(response.json()).resolves.toEqual({
+      error: "A tool and a Bot are required.",
+    });
+    expect(calls.toolCalls).toEqual([]);
+  });
+});